Bug 27073 – Crash in WebDragClient::willPerformDragSource

• Component: New Bugs
• Status: RESOLVED FIXED

[Mihnea Ovidenie]

While using version 45604 nightly on WindowXP i encountered a crash.

Steps to reproduce:
1. Go to webkit.org
2. After the page is loaded, click in url bar and select the whole url text
3. Try to drag the selected text
4. WebKit will crash

The crash can be seen on Windows Vista too. The crash is not reproducible in Safari 4 on Windows.

I also downloaded latest version of WebKit source, made a debug build and start a debug session with WebKitTools\Script\debug-safari.
The stack trace when crashed:

WebKit.dll!WebDragClient::willPerformDragSourceAction(WebCore::DragSourceAction action=DragSourceActionSelection, const WebCore::IntPoint & intPoint={...}, WebCore::Clipboard * clipboard=0x066fb040)  Line 117 + 0x46 bytes	C++
WebKit.dll!WebCore::DragController::startDrag(WebCore::Frame * src=0x042943c0, WebCore::Clipboard * clipboard=0x066fb040, WebCore::DragOperation srcOp=DragOperationNone, const WebCore::PlatformMouseEvent & dragEvent={...}, const WebCore::IntPoint & dragOrigin={...}, bool isDHTMLDrag=false)  Line 699 + 0x21 bytes	C++
WebKit.dll!WebCore::EventHandler::handleDrag(const WebCore::MouseEventWithHitTestResults & event={...})  Line 2256 + 0x44 bytes	C++
WebKit.dll!WebCore::EventHandler::handleMouseDraggedEvent(const WebCore::MouseEventWithHitTestResults & event={...})  Line 406 + 0xc bytes	C++
WebKit.dll!WebCore::EventHandler::handleMouseMoveEvent(const WebCore::PlatformMouseEvent & mouseEvent={...}, WebCore::HitTestResult * hoveredNode=0x0012f76c)  Line 1371 + 0xc bytes	C++
WebKit.dll!WebCore::EventHandler::mouseMoved(const WebCore::PlatformMouseEvent & event={...})  Line 1263 + 0x10 bytes	C++
WebKit.dll!WebView::handleMouseEvent(unsigned int message=512, unsigned int wParam=1, long lParam=524366)  Line 1324 + 0x1d bytes	C++
WebKit.dll!WebViewWndProc(HWND__ * hWnd=0x0012106c, unsigned int message=512, unsigned int wParam=1, long lParam=524366)  Line 1858 + 0x14 bytes	C++
user32.dll!_InternalCallWinProc@20()  + 0x28 bytes	
user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes	
user32.dll!_CallWindowProcAorW@24()  + 0x51 bytes	
user32.dll!_CallWindowProcW@20()  + 0x1b bytes	
comctl32.dll!_CallOriginalWndProc@24()  + 0x1a bytes	
comctl32.dll!_CallNextSubclassProc@20()  + 0x3c bytes	
comctl32.dll!_DefSubclassProc@16()  + 0x46 bytes	
comctl32.dll!TTSubclassProc()  + 0x59 bytes	
comctl32.dll!_CallNextSubclassProc@20()  + 0x3c bytes	
comctl32.dll!_MasterSubclassProc@16()  + 0x54 bytes	
user32.dll!_InternalCallWinProc@20()  + 0x28 bytes	
user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes	
user32.dll!_DispatchMessageWorker@8()  + 0xdc bytes	
user32.dll!_DispatchMessageW@4()  + 0xf bytes	
Safari.exe!0046caf5() 	
[Frames below may be incorrect and/or missing, no symbols loaded for Safari.exe]	
user32.dll!__EndUserApiHook@0()  + 0x11 bytes	
user32.dll!_UserCallWinProcCheckWow@32()  + 0xfb bytes	
user32.dll!_UserCallWinProcCheckWow@32()  + 0xcb bytes	
WebKit.dll!string "WTF::HashTable<struct _NPStream "...()  + 0x8a9 bytes	C++
user32.dll!_fnHkINLPCWPRETSTRUCTW@20()  + 0x5e bytes	
user32.dll!___fnDWORD@4()  + 0x24 bytes	
ntdll.dll!_KiUserCallbackDispatcher@12()  + 0x13 bytes	
user32.dll!_NtUserRedrawWindow@16()  + 0xc bytes	
Safari.exe!00422021() 	
pthreadVC2.dll!696032fe() 	
Safari.exe!0041cd9b() 	
Safari.exe!0046d686() 	
Safari.exe!00424034() 	
Safari.exe!0065ef57() 	
Safari.exe!0065f714() 	
kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes	
Safari.exe!00740061() 	
Safari.exe!00740069() 	
Safari.exe!006f0073() 	
Safari.exe!006f0073() 	
Safari.exe!006f0073() 	
Safari.exe!006f0073() 	
Safari.exe!005c0032() 	
Safari.exe!005c0032() 	
Safari.exe!005c0032() 	
Safari.exe!005c0032() 	

Regards,
Mihnea

[Mihnea Ovidenie]

Created attachment 32437 [details]
DrWatson Log for the crash with nightly 45604

[Mihnea Ovidenie]

Created attachment 32438 [details]
User dump for the crash with nightly 45604

[Mihnea Ovidenie]

While debugging the crash, i have noticed that i was not able to load the symbols for Safari. Is the symbol server still working?

Regards,
Mihnea

[Mark Rowe (bdash)]

<rdar://problem/7078547>

[Ryosuke Niwa]

*** Bug 27519 has been marked as a duplicate of this bug. ***

[Ryosuke Niwa]

(In reply to comment #5)
> *** Bug 27519 has been marked as a duplicate of this bug. ***

I did copy & paste from visual studio so you might find helpful to go visit 27519 as well.

[Steve Falkenburg]

I am not seeing this in Safari 4.0.3 + nightly r47409 on Vista.

[Mihnea Ovidenie]

Hi,

I have tested on my xp machine with both Safari 5.0.3 and nightly 74232 and the problem cannot be reproduced anymore.

Regards,
Mihnea

[Adam Roben (:aroben)]

(In reply to comment #8)
> Hi,
> 
> I have tested on my xp machine with both Safari 5.0.3 and nightly 74232 and the problem cannot be reproduced anymore.

Thanks for retesting (and for filing the bug in the first place)!